{{vm.error.header}}

Security advisory: Update ClientDependency immediately

A newly found security issue could lead to disclosure of private information. We have provided a fix for the affected sites. Please make sure your sites are updated immediately to fix the issue. Umbraco Cloud sites and sites on version 7.2.3 and above are not affected.

February 16th 2017

Impact: High, requires immediate action. This advisory is the result of a private penetration test, we have no reports that the bug is being exploited in the wild.

The following Umbraco versions needs to be updated:

4.11.9 - 4.11.10

6.0.6 - 6.2.6

7.0.0 - 7.2.2

any Umbraco website using ClientDependency version 1.8.2.1 or lower

If you have a different Umbraco version than the ones listed above but you have version 1.8.2.1 of ClientDependency running in your website then you also need to update.

Update, Feb 16 16:57 GMT+1: If you have ever upgraded your site from a version below 7.2.3 then you should check the version of ClientDependency.Core.dll (it should be 1.8.3.1 or higher) and you have to go into your live environment and find either the ~/App_Data/ClientDependencyfolder or the ~/App_Data/Temp/ClientDependency folder and DELETE all the files in that folder, old cached files may still expose private information if you leave them there.

Does my site need to be updated?

If you are uncertain about what version you are running, get in touch with the person / agency that built your Umbraco site and let them help you. It is an easy fix, but we only recommend experienced Umbraco users to do the update.

This version is fully backwards compatible with version 1.8.2.1 so you don't need to worry about breaking anything.

Note: After copying in the new version you have to go into your live environment and find either the ~/App_Data/ClientDependency folder or the ~/App_Data/Temp/ClientDependency folder and DELETE all the files in that folder, old cached files may still expose private information if you leave them there.

NuGet

If your ARE using NuGet then the following instructions apply. Run the following command in your Package Manager Console in Visual Studio:

Update-Package ClientDependency -Version 1.8.3.1

If you don't specify the version in this command you will be upgraded to the latest version.

Alternatively you can use the NuGet UI to search for the ClientDependency package and update it to either version 1.8.3.1 or the latest version.

Note: After upgrading to the new version you have to go into your live environment and find either the ~/App_Data/ClientDependencyfolder or the ~/App_Data/Temp/ClientDependency folder and DELETE all the files in that folder, old cached files may still expose private information if you leave them there.

Questions?

If you have additional questions not covered in this blog post please use the forum post on Our Umbraco dedicated to this topic. You can subscribe to email notifications for this forum post (hit the "follow" button at the top right) to receive updates.

Details about the issue

Summary:A library used by Umbraco contains a security flaw

Fix: Replace a single assembly file or run a NuGet update command. Completely backwards compatible.

The newly discovered vulnerability is no longer present in version 1.8.3.1 of ClientDependency and we advise you to make sure that you are using at least version 1.8.3.1. Of course, to get the most stable version with extra bug fixes you should upgrade to the latest stable version (1.9.2).

Saniona is a research and development company focused on drugs for diseases of the central nervous system, autoimmune diseases, metabolic diseases and treatment of pain. With Saniona's 2016 launch on the Nasdaq, it was important that their website could easily and seamlessly present relevant investor and trading information. Look how WebVision did the job.

Story by WebVision

2 minute read

If you don't know Umbraco, here are some numbers behind the world's friendliest CMS

One of the biggest benefits of using Umbraco is that the community is incredibly pro-active, extremely friendly and helpful.

Chances are that if you get an idea for something you would like to build in Umbraco, someone has already built it. So it is very likely that you can get good and friendly advice from someone from the Umbraco community on Our- just ask.

Number of active installs

443.450

Number of active members in the community

221.745

Known free Umbraco packages available

1.211

Want to be updated on everything Umbraco?

Be one of the first to know about special offers on our products and services. Get invitations to Umbraco events and festivals sent directly to your inbox.

All you need to do is get on our mailing list and soon you'll become a true Umbraco-know-it-all.